EUVD-2026-102517
GHSA-98wv-2mg3-gmcv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
DeliveryServe crafted HTML payload
-
ExploitTrigger improper input validation flaw
-
ExecutionEscape renderer sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to use Google Chrome Desktop on a version prior to 155.0.8059.84 and to load attacker-controlled crafted HTML content (UI:R - the user must open/visit the malicious page); no authentication or prior privileges are needed (PR:N). The limiting factors are the mandatory user interaction and the need to deliver the crafted page (e.g., via a malicious site, malvertising, or compromised page); no non-default configuration is indicated. Successful arbitrary code execution additionally depends on defeating Chrome's renderer sandbox, which is a non-trivial step that SSVC rates as not automatable. |
| Impact | Signals are mixed and should be reconciled before prioritization. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6 Critical) reflects a sandbox escape with scope change and full impact, triggered by an unauthenticated remote attacker but gated by user interaction (UI:R). Notably, Google's own Chromium security severity is labeled Medium, which conflicts with the 9.6 Critical CVSS - a common divergence because Chromium's rating weighs exploitability/mitigations while CVSS weights the sandbox-escape scope change heavily; treat the 9.6 as the worst-case technical ceiling, not a statement of ease. Exploitation-likelihood signals are low: EPSS is 0.21% (11th percentile), there is no CISA KEV listing, and SSVC reports Exploitation=none and Automatable=no (no mass/wormable exploitation expected), while Technical Impact=total aligns with the C:H/I:H/A:H sandbox escape. No public exploit identified at time of analysis. Net: this is a high-impact-but-not-yet-exploited browser flaw - patch promptly as part of routine Chrome update hygiene, but current data does not indicate active or imminent widespread exploitation. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the improper input validation flaw in Chrome Desktop; a victim running a version prior to 155.0.8059.84 visits the page (UI:R), and the attacker potentially escapes the renderer sandbox to execute arbitrary code on the host. Because AC:L/PR:N apply, no privileges or special conditions are needed beyond luring the user to the content, but no public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Improper input validation in Google Chrome Desktop versions prior to 155.0.8059.84 could let a remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector scores 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), meaning no authentication is required but the victim must interact with attacker-supplied content, and the Changed Scope rating implies a security-boundary crossing such as an escape from the renderer sandbox - a non-trivial step that CISA's SSVC rates as not automatable. Despite the critical base score, the practical risk signal is mixed at time of analysis: exploitation status is none per SSVC, no public exploit code has been identified, and EPSS is only 0.21% (11th percentile), while Chromium's own severity classification for this issue is Medium and a vendor patch is available.
RemediationAI
Vendor-released patch: upgrade Google Chrome Desktop to 155.0.8059.84 or later, which is delivered through the stable channel update documented at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html (the underlying bug reference is https://issues.chromium.org/issues/501886301). Chrome's built-in updater normally applies this automatically; verify the installed build via chrome://version and confirm the value is at least 155.0.8059.84, then force a relaunch because the fix only takes effect after the browser restarts. Until the update is verified on all endpoints, specific compensating controls are: (1) keep the renderer sandbox and Site Isolation enabled and never launch Chrome with --no-sandbox, since the exploit depends on escaping that boundary; (2) restrict user exposure to untrusted web content through enterprise URL allow/block policies or proxy/DNS filtering of known malvertising and low-reputation domains - effective against drive-by delivery but restrictive and high-maintenance for general browsing fleets; (3) enforce Enhanced Safe Browsing, which improves detection of malicious pages but sends more telemetry to Google and can also be bypassed by freshly staged or compromised-legitimate sites; (4) run high-risk browsing sessions inside a disposable VM or container to contain any code that does escape the sandbox, at the cost of performance and user friction; and (5) reduce attack surface by disabling unused web platform features and unvetted extensions, which lowers the number of reachable input-validation paths but is not a reliable substitute for patching. Because the mandatory user-interaction prerequisite (UI:R) is the attacker's main hurdle, user-awareness messaging about unsolicited links and malvertising complements - but does not replace - the version upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-20 (Improper Input Validation) in Chrome's Desktop rendering path, where crafted HTML content is not sufficiently validated before it is processed, creating a memory-safety or logic condition that a remote attacker can steer toward arbitrary code execution. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. the Chrome browser before the fixed 155.0.8059.84 build, tracked by Google as Chromium issue 501886301 and mirrored as ENISA EUVD-2026-102517 and VulDB 420961. The Changed Scope (S:C) component of the assessed vector is the key technical detail: rather than a plain in-process corruption, the impact is rated as extending beyond the vulnerable component's own security authority, consistent with a possible sandbox-escape scenario in which code runs outside the Chrome renderer sandbox. That said, the description uses the word 'potentially', and SSVC explicitly marks the flaw as not automatable and with exploitation not observed, so the out-of-sandbox outcome should be treated as the worst-case consequence of a successful exploit chain rather than a demonstrated, scriptable attack. Note also the discrepancy between the 9.6 CVSS base score and Chromium's Medium severity rating, which reflects the difference between theoretical worst-case scoring and the vendor's practical assessment of exploitability and mitigation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted HTML needs no privileges (PR:N) but requires the user to open the page (UI:R); sandbox escape crosses a trust boundary (S:C) with full code-execution impact (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
A critical-severity input-validation flaw affects Google Chrome Desktop versions prior to 155.0.8059.84, allowing a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox after a user simply loads a crafted HTML page. Because Chrome is one of the most widely deployed applications across the workforce, this issue potentially exposes every browsing user in the organization and directly undermines the browser sandbox that leadership relies on to contain web-borne threats. The practical risk signal is currently mixed - there is no public exploit identified at time of analysis and vendor severity is rated Medium - but the potential for a full sandbox escape on a ubiquitous platform warrants prioritized remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB